14 matches found
CVE-2026-90800
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...
CVE-2026-90797
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...
CVE-2026-90799
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...
EUVD-2026-105100
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...
CVE-2026-90800
Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to an authentication bypass in the chttpd component. The root cause is missing authorization checks, which allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorized API endpo...
CVE-2026-90800 Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...
CVE-2026-90800 Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...
CVE-2026-90799
Apache CouchDB version 3.5.2 and below are vulnerable to a denial of service attack on all platforms. The root cause is unsafe binary deserialisation within the chttpd component, which can be triggered by an authenticated user providing specially crafted sequence values in _changes sequences and ...
EUVD-2026-105158
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...
CVE-2026-90799 Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...
CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...
CVE-2026-90797
Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to a pre-authentication gzip decompression bomb . The issue resides in the chttpd component, where an unlimited gzip decompression routine allows a remote client to trigger a denial of service (DoS) by causing memory exhausti...
EUVD-2026-105156
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...
CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...